HyperFound — Cookie Policy
Last updated: 28 September 2026. Binding language: English.
This Policy explains how HyperFound (operated by Tom Marx, autónomo, Sotogrande, Spain) uses cookies and similar device-storage technologies on hyperfound.ai and the HyperFound app. Statutory basis: LSSI-CE Art. 22.2 and the GDPR / Spanish LOPDGDD. We obtain prior consent for non-essential storage and rely on the strictly-necessary exemption for the rest.
1. What these technologies are
Cookies and similar technologies (localStorage, sessionStorage) store small amounts of data on your device. Spanish law (Art. 22.2 LSSI) covers all such storage, not only cookies.
2. Cookies & storage we use
The only non-essential technology on our site is analytics (Google Analytics 4). We use no advertising, retargeting, or social-media tracking cookies.
Cookies
| Name | Purpose | Duration | Category | Consent? |
|---|---|---|---|---|
sb-* (Supabase auth) | Keep you signed in. Set for hyperfound.ai and its subdomains, so one sign-in covers the website and the app | Up to 400 days, renewed while you use the app | Strictly necessary | No |
hf_active_org_id | Remember your active organisation | 30 days | Strictly necessary | No |
hf_active_workspace_id | Remember your active workspace | 30 days | Strictly necessary | No |
*_oauth_state (GA4/GSC/Slack) | OAuth security (CSRF) while you connect an integration | 10 minutes | Strictly necessary | No |
ga4_oauth_workspace, gsc_oauth_workspace | Remember which workspace you are connecting to Google | 10 minutes | Strictly necessary | No |
shared_session_* | Authenticate a password-protected share view; sent only to that link's own data address | 1 hour | Strictly necessary | No |
hf_currency | Show prices in your currency, from the country our hosting provider reports for your connection or from your choice on the pricing page | 1 year | Functional (necessary) | No |
_ga, _ga_* | Google Analytics — usage measurement | 2 years | Analytics (non-essential) | Yes |
Browser storage
| Name | Purpose | Duration | Category | Consent? |
|---|---|---|---|---|
hf_consent (localStorage) | Remember your cookie choice | Persistent | Strictly necessary | No |
hyperfound_onboarding_draft*, hyperfound_onboarding_draft_owner (localStorage) | Save your onboarding answers so you can resume; the owner entry holds your account ID, so a draft is never shown to a different account on the same browser | Removed when you finish onboarding | Strictly necessary | No |
hf_ob_ws, hf_ob_org, hf_ob_domain (sessionStorage) | Carry your new workspace through the onboarding scan | Tab session | Strictly necessary | No |
hf_promo (sessionStorage) | Carry a promo code through signup | Tab session | Functional (necessary) | No |
theme (localStorage) | Remember light/dark preference | Persistent | Functional (necessary) | No |
hf:lastAuthMethod (localStorage) | Remember how you last signed in, to offer it first | 90 days | Functional (necessary) | No |
hyperfound_onboarding_progress, hyperfound_script_verified, hyperfound_script_lastchecked (localStorage) | Remember your setup progress and the last tracking-script check | Persistent | Functional (necessary) | No |
Interface state: hf-sidebar-*, hf-mobile-nav-variant, hf.prompts.*, hf-upgrade-dismissed-* (localStorage); hf-budget-reduced-dismissed (sessionStorage) | Remember collapsed panels, recently visited pages and dismissed notices | Persistent (localStorage) or tab session (sessionStorage) | Functional (necessary) | No |
Bot protection
Two forms that start work on our side — the GEO report request and the research step of onboarding — are protected by Vercel BotID, our hosting provider's bot check. When you submit one of them, the request carries signals that a Vercel script collects in your browser, which Vercel uses to tell people from automated traffic. We use it only to protect these forms from abuse, which is why we treat it as strictly necessary.
In our emails
Some of our emails contain a small image that tells us when the email is opened, and their links pass through our site so we can see which link was followed. This is described in our Privacy Policy; every such email carries an unsubscribe link.
3. Analytics & your consent
Google Analytics 4 runs in Google Consent Mode v2, denied by default — until you consent, no analytics cookies (_ga, _ga_*) are set and GA runs in a cookieless mode. On your first visit a cookie-settings notice appears; you grant or refuse analytics there, and "Reject" is as easy as "Accept." Refusing leaves all non-essential storage off. You can change your choice at any time via the "Cookie settings" link in our footer. Analytics is suppressed entirely on pages opened from a private link (share views, report links and invitations).
International transfer: GA4 data may be processed by Google LLC (US); such transfers rely on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. See our Privacy Policy.
4. Managing cookies
Use the "Cookie settings" link (in the footer, or the button on this page) to change a saved choice — the cookie-settings notice reappears. You can also use your browser settings to block or delete cookies; blocking strictly-necessary cookies may break sign-in and core functions.
5. Changes & contact
We update this Policy as our practices change; the "Last updated" date reflects the current version. Questions: tom@hyperfound.ai.